chore(deps): bump the cargo-dependencies group across 1 directory with 3 updates

Bumps the cargo-dependencies group with 3 updates in the / directory: [quick-xml](https://github.com/tafia/quick-xml), [zip](https://github.com/zip-rs/zip2) and [skrifa](https://github.com/googlefonts/fontations).


Updates `quick-xml` from 0.41.0 to 0.42.0
- [Release notes](https://github.com/tafia/quick-xml/releases)
- [Changelog](https://github.com/tafia/quick-xml/blob/master/Changelog.md)
- [Commits](https://github.com/tafia/quick-xml/compare/v0.41.0...v0.42.0)

Updates `zip` from 3.0.0 to 9.1.0
- [Release notes](https://github.com/zip-rs/zip2/releases)
- [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md)
- [Commits](https://github.com/zip-rs/zip2/compare/v3.0.0...v9.1.0)

Updates `skrifa` from 0.44.0 to 0.48.0
- [Release notes](https://github.com/googlefonts/fontations/releases)
- [Changelog](https://github.com/googlefonts/fontations/blob/main/docs/RELEASE.md)
- [Commits](https://github.com/googlefonts/fontations/compare/skrifa-v0.44.0...skrifa-v0.48.0)

---
updated-dependencies:
- dependency-name: quick-xml
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-dependencies
- dependency-name: skrifa
  dependency-version: 0.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-dependencies
- dependency-name: zip
  dependency-version: 9.0.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Cargo.lock

@@ -195,15 +195,6 @@ version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
-[[package]]
-name = "arbitrary"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3bc62ac97cc33321f50863d514c3bc38a453947a8f9e781137e47c7401020aed"
-dependencies = [
- "derive_arbitrary",
-]
-
 [[package]]
 name = "arboard"
 version = "3.7.0"
@@ -941,7 +932,7 @@ dependencies = [
  "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
- "skrifa",
+ "skrifa 0.44.0",
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
@@ -969,7 +960,7 @@ dependencies = [
  "verifysign",
  "winreg",
  "winsafe",
- "zip 9.1.0",
+ "zip",
 ]
 
 [[package]]
@@ -1107,17 +1098,6 @@ version = "0.5.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e9de72ce2ad1f90dc62fa25f0f430ef85eb4b0d8fa0be4f30373bc40a21d28e"
 
-[[package]]
-name = "derive_arbitrary"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b034bd7d5f032402a2479444dcc6f74e36a03f31854d41680fb240ef682a1ac"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.6",
-]
-
 [[package]]
 name = "dify"
 version = "0.8.0"
@@ -1428,7 +1408,7 @@ dependencies = [
  "parking_lot",
  "profiling",
  "self_cell",
- "skrifa",
+ "skrifa 0.44.0",
  "smallvec",
  "unicode-bidi",
  "unicode-general-category",
@@ -1623,9 +1603,9 @@ checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
 [[package]]
 name = "font-types"
-version = "0.12.6"
+version = "0.12.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c92d9081c7ab3bd83ef1eecdfad090f3d966e3ce74106779664114cfe1a6274"
+checksum = "835ae9d781464a79026cde387f9cbc650c9a4909d7cf7e658b127e3c35d2f35d"
 dependencies = [
  "bytemuck",
 ]
@@ -1836,7 +1816,7 @@ dependencies = [
  "hashbrown 0.17.1",
  "log",
  "peniko",
- "skrifa",
+ "skrifa 0.44.0",
  "smallvec",
  "vello_common",
 ]
@@ -1935,7 +1915,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft"
-version = "0.13.0"
+version = "0.12.1"
 dependencies = [
  "arboard",
  "chrono",
@@ -1962,7 +1942,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-calc"
-version = "0.13.0"
+version = "0.12.1"
 dependencies = [
  "gridcraft-core",
  "gridcraft-formula",
@@ -1974,7 +1954,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-chart"
-version = "0.13.0"
+version = "0.12.1"
 dependencies = [
  "gridcraft-calc",
  "gridcraft-core",
@@ -1985,19 +1965,19 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-cli"
-version = "0.13.0"
+version = "0.12.1"
 dependencies = [
  "gridcraft-engine",
  "gridcraft-mcp",
  "log",
- "quick-xml 0.41.0",
+ "quick-xml 0.42.0",
  "serde_json",
- "zip 3.0.0",
+ "zip",
 ]
 
 [[package]]
 name = "gridcraft-core"
-version = "0.13.0"
+version = "0.12.1"
 dependencies = [
  "chrono",
  "js-sys",
@@ -2008,7 +1988,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-engine"
-version = "0.13.0"
+version = "0.12.1"
 dependencies = [
  "gridcraft-calc",
  "gridcraft-chart",
@@ -2025,12 +2005,12 @@ dependencies = [
  "serde_json",
  "thiserror 2.0.21",
  "web-time",
- "zip 3.0.0",
+ "zip",
 ]
 
 [[package]]
 name = "gridcraft-formula"
-version = "0.13.0"
+version = "0.12.1"
 dependencies = [
  "gridcraft-core",
  "serde",
@@ -2039,7 +2019,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-functions"
-version = "0.13.0"
+version = "0.12.1"
 dependencies = [
  "gridcraft-core",
  "regex",
@@ -2047,7 +2027,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-mcp"
-version = "0.13.0"
+version = "0.12.1"
 dependencies = [
  "gridcraft-engine",
  "log",
@@ -2056,7 +2036,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-model"
-version = "0.13.0"
+version = "0.12.1"
 dependencies = [
  "gridcraft-core",
  "gridcraft-formula",
@@ -2068,18 +2048,18 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-numfmt"
-version = "0.13.0"
+version = "0.12.1"
 dependencies = [
  "gridcraft-core",
 ]
 
 [[package]]
 name = "gridcraft-pdf"
-version = "0.13.0"
+version = "0.12.1"
 
 [[package]]
 name = "gridcraft-ui-egui"
-version = "0.13.0"
+version = "0.12.1"
 dependencies = [
  "craft-ui",
  "craft-update",
@@ -2094,7 +2074,7 @@ dependencies = [
  "log",
  "serde",
  "serde_json",
- "skrifa",
+ "skrifa 0.48.0",
  "sys-locale",
  "toml",
  "web-sys",
@@ -2104,7 +2084,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-web"
-version = "0.13.0"
+version = "0.12.1"
 dependencies = [
  "eframe",
  "egui",
@@ -2121,18 +2101,18 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-xlsx"
-version = "0.13.0"
+version = "0.12.1"
 dependencies = [
  "aes",
  "gridcraft-core",
  "gridcraft-formula",
  "gridcraft-functions",
  "gridcraft-model",
- "quick-xml 0.41.0",
+ "quick-xml 0.42.0",
  "sha1 0.11.0",
  "sha2 0.11.1",
  "thiserror 2.0.21",
- "zip 3.0.0",
+ "zip",
 ]
 
 [[package]]
@@ -2183,7 +2163,7 @@ checksum = "c03d949a14aa089bbb282f7dd76a498a7f684428e4257202efc119ec010376f9"
 dependencies = [
  "bitflags 2.13.2",
  "bytemuck",
- "read-fonts",
+ "read-fonts 0.41.0",
  "smallvec",
 ]
 
@@ -3985,6 +3965,19 @@ dependencies = [
  "once_cell",
 ]
 
+[[package]]
+name = "read-fonts"
+version = "0.45.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4edc8db0d972de88e53a085b1f01fb3fbdae7bb0cb7a0ce2b2f8285a412fe3ef"
+dependencies = [
+ "bytemuck",
+ "foldhash 0.2.0",
+ "font-types",
+ "once_cell",
+ "yoke",
+]
+
 [[package]]
 name = "redox_syscall"
 version = "0.4.1"
@@ -4707,7 +4700,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "819ab7d62b1d3e72d9d9dea5650bac30424f9111364bb94928dbf5ecad1baa68"
 dependencies = [
  "bytemuck",
- "read-fonts",
+ "read-fonts 0.41.0",
+]
+
+[[package]]
+name = "skrifa"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5213b4825bac3587046330052d61bfac7bd3bd0d203c758d7c2ef726fcea034"
+dependencies = [
+ "bytemuck",
+ "read-fonts 0.45.1",
 ]
 
 [[package]]
@@ -6402,7 +6405,7 @@ checksum = "e450f9b2ed1dff33c94c12589a87338689467b9c4f5d8a5710bd09a847d2c8a7"
 
 [[package]]
 name = "xtask"
-version = "0.13.0"
+version = "0.12.1"
 dependencies = [
  "gridcraft-engine",
  "serde_json",
@@ -6635,20 +6638,6 @@ dependencies = [
  "syn 3.0.6",
 ]
 
-[[package]]
-name = "zip"
-version = "3.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12598812502ed0105f607f941c386f43d441e00148fce9dec3ca5ffb0bde9308"
-dependencies = [
- "arbitrary",
- "crc32fast",
- "flate2",
- "indexmap",
- "memchr",
- "zopfli",
-]
-
 [[package]]
 name = "zip"
 version = "9.1.0"

Cargo.toml

@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/gridcraft", "apps/gridcraft-cli", "xtask"]
 
 [workspace.package]
-version = "0.13.0"
+version = "0.12.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -38,8 +38,8 @@ chrono = { version = "0.4.45", default-features = false, features = ["std", "clo
 web-time = "1.1.0"
 rayon = "1"
 regex = { version = "1", default-features = false, features = ["std", "unicode", "perf"] }
-quick-xml = "0.41"
-zip = { version = "3", default-features = false, features = ["deflate"] }
+quick-xml = "0.42"
+zip = { version = "9", default-features = false, features = ["deflate"] }
 sha2 = { version = "0.11", default-features = false }
 # Decrypting password-protected workbooks ([MS-OFFCRYPTO]): AES and SHA-1, pure Rust (wasm-safe).
 aes = { version = "0.9", default-features = false }
@@ -57,7 +57,7 @@ arboard = { version = "3.6", default-features = false }
 sys-locale = "0.3"
 # Font parser egui's epaint uses; the UI validates system font files with it before handing them
 # to egui, which panics on a file it can't parse. Same version as epaint's, so no second copy.
-skrifa = { version = "0.44", default-features = false, features = ["std"] }
+skrifa = { version = "0.48", default-features = false, features = ["std"] }
 # Real font bytes for tests (Ubuntu Light, compiled into epaint).
 epaint_default_fonts = "0.37"
 # One native window per workbook: the window list, Window menu titles and the immediate-viewport

packaging/linux/flatpak/ai.storyteller.gridcraft.bundle.yml

@@ -22,8 +22,6 @@ finish-args:
   - --socket=fallback-x11
   # X11 shared memory (MIT-SHM). Without it the X11 fallback is slow or fails.
   - --share=ipc
-  # Network access for update checks against GitHub.
-  - --share=network
   # GPU access for rendering.
   - --device=dri
   # Open/Save dialogs use the file-chooser portal (rfd), and drag-and-drop uses the document
@@ -31,7 +29,9 @@ finish-args:
   # opening workbooks by path from the command line.
   - --filesystem=xdg-documents
   - --filesystem=xdg-download
-  # Network: update checks reach GitHub. Home/host filesystem access is deliberately not granted.
+  # Deliberately not granted: network (the optional --control channel listens on 127.0.0.1 in
+  # the sandbox; `flatpak override --user --share=network ai.storyteller.gridcraft` exposes it to
+  # host agents) and home/host filesystem access.
 modules:
   - name: gridcraft
     buildsystem: simple

packaging/linux/flatpak/ai.storyteller.gridcraft.yml

@@ -23,8 +23,6 @@ finish-args:
   - --socket=fallback-x11
   # X11 shared memory (MIT-SHM). Without it the X11 fallback is slow or fails.
   - --share=ipc
-  # Network access for update checks against GitHub.
-  - --share=network
   # GPU access for rendering.
   - --device=dri
   # Open/Save dialogs use the file-chooser portal (rfd), and drag-and-drop uses the document
@@ -32,7 +30,9 @@ finish-args:
   # opening workbooks by path from the command line.
   - --filesystem=xdg-documents
   - --filesystem=xdg-download
-  # Network: update checks reach GitHub. Home/host filesystem access is deliberately not granted.
+  # Deliberately not granted: network (the optional --control channel listens on 127.0.0.1 in
+  # the sandbox; `flatpak override --user --share=network ai.storyteller.gridcraft` exposes it to
+  # host agents) and home/host filesystem access.
 build-options:
   append-path: /usr/lib/sdk/rust-stable/bin
 modules: